IBM MQ Console contains an improper authorization vulnerability (CWE-285) that permits authenticated users without administrative privileges to create and start queue managers. This occurs because the authorization checks are not properly enforced, allowing privilege escalation within the MQ management interface. The vulnerability affects IBM MQ versions 9.3.0.0, 9.4.0.0, and 10.0.0.0. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The impact includes potential integrity loss and high availability impact due to unauthorized queue manager operations.

The vulnerability allows non-administrative authenticated users to create and start queue managers, which can lead to unauthorized modification of MQ configurations and disruption of MQ services. This could affect the availability of messaging services and potentially compromise the integrity of message processing within affected IBM MQ environments.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict access to IBM MQ Console to trusted administrative users only and monitor user privileges carefully to prevent exploitation.